CVE-2024-41503 PoC — Jetimob Plataforma Imobiliaria 安全漏洞

介绍

# CVE-2024-41503

- **CVE:** CVE-2024-41503
- **Software:** Jetimob Plataforma Imobiliaria (CRM/ERP/CMS)
- **Version:** 20240627-0
- **Vulnerability:** Stored Cross-Site Scripting (XSS)
- **Description:** The "Busca" (search) function used throughout the application contains a filter option that can be saved - when saving it, there is a "Título" form field that allows injection of JavaScript code, storing the code in the application. It is then executed when the filter is created or when clicking to delete it, when the deletion confirmation window containing the payload appears.
- **Payload:** `<img src=x onerror=alert(document.cookie)>`

![](img/1.png)  

![](img/2.png)  

![](img/3.png)

文件快照

备注